CVE-2026-15369: CWE-269 Improper Privilege Management in Addify Custom User Registration Fields for WooCommerce

CVE-2026-15369 is a privilege escalation vulnerability in the Addify Custom User Registration Fields for WooCommerce plugin. The vulnerability arises from the plugin accepting an unauthenticated afreg_select_user_role parameter via the WooCommerce Store API /wc/store/v1/checkout endpoint. This value is stored in order meta and later passed directly to WP_User::add_role() without validation against the plugin's allowed roles list. Consequently, attackers can create accounts with elevated privileges, including Administrator, by modifying the JSON request body during checkout. The exploit requires the "User Role Selection" feature to be enabled. No official patch or remediation guidance is currently provided.

Successful exploitation allows unauthenticated attackers to escalate their privileges to Administrator or any other role by creating an account with a crafted role value. This leads to full control over the WordPress site, including the ability to modify content, install plugins, and manage users, resulting in complete compromise of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable the "User Role Selection" setting in the plugin configuration to prevent attackers from specifying arbitrary roles during checkout.